Security at Soft Souq
Card data never hits our servers. Downloads only work after payment, through a short-lived signed link.
No cards on our servers
Checkout redirects to Tap Payments. This site never sees or stores PAN data.
Hardened sessions
HttpOnly JWT cookies, SameSite, and bcrypt password hashes.
Signed downloads
Only a paid order gets an HMAC link that expires in 15 minutes and is single-use.
Constrained uploads
zip/msi/exe/dmg/apk only, size-capped, random names, no path traversal.
Security headers
CSP, HSTS, clickjacking protection, and rate limits on auth, pay, and upload.
Qatar readiness
Prices in QAR. Turn on 3-D Secure in Tap and complete local business onboarding before live sales.